Use this guide to link the 1Password desktop app with the Zen Browser extension on Linux and macOS. The link gives biometric open for the extension and keeps the lock state in sync with the desktop app. Windows users rely on the extension alone, which works fine on its own. The default link fails because 1Password trusts only a short list of browsers, and Zen falls outside that list today.

The sections below explain why the link matters, what blocks the link, and how to enable the link in a safe and simple way.

What you get

The link removes extra password prompts and keeps focus on real work. A single open in the desktop app also opens the extension in Zen, which reduces friction during daily browsing. A single lock in the desktop app also locks the extension, which helps prevent mistakes when stepping away from the keyboard. Touch ID or another biometric on the desktop app also opens the extension, so no need to retype a long master password in the browser.

• Fewer prompts and fewer context switches during login flows.
• Shared open/lock state between desktop app and browser extension.
• Biometric support for the extension through the desktop app.

Why it fails

1Password ships with a list of "trusted browsers" that receive permission to talk to the desktop app. Zen Browser remains new and below the usage threshold that 1Password uses for that list, so no trust record exists yet. The extension in Zen still works alone, but no private bridge forms between the desktop app and the extension until Zen appears in the trusted list. Adding Zen to that list removes the block and allows a secure connection that passes account information and encryption keys between the two sides.

Before you start

Set up the 1Password desktop app and sign in to a regular account. Install the official 1Password extension in Zen from the standard source used for other browsers. Keep Administrator access ready for Linux changes, because a system folder stores a small allowlist for trusted browsers. Plan to quit and reopen both apps after changes, which clears stale state and forces a fresh handshake between desktop and extension.

Linux

On Linux, 1Password reads an allowlist from a text file named custom_allowed_browsers. Each line in that file holds one browser process name, and 1Password grants trust to any process that matches a line. Zen Browser uses a process name named zen-bin in common builds, so adding that name to the file gives the desktop app permission to form a private bridge to the extension. The change affects only trust decisions for the desktop bridge and does not weaken vault security or change account data.

Run this commands in a terminal, then reopen both apps:

sudo mkdir -p /etc/1password
sudo touch /etc/1password/custom_allowed_browsers
echo "zen-bin" | sudo tee -a /etc/1password/custom_allowed_browsers

Some Linux builds ship a different process name for Zen. Run pgrep -a zen to view running processes and confirm the exact name on the local system. If a different name appears, add that name to the file instead of zen-bin. After editing, quit and reopen 1Password, then quit and reopen Zen, which forces a fresh bridge attempt.

macOS

On macOS, the desktop app includes a simple picker that adds a browser bundle to the trusted list. Open the 1Password app, open Settings, then open the Browser tab. Select Add Browser, choose Zen Browser from Applications, and approve any prompts from the system. That action records trust for the Zen Browser bundle and allows a private bridge between desktop and extension. Afterward, quit and reopen 1Password, then quit and reopen Zen, which triggers a clean handshake.

How to confirm success

Most issues come from a missing allowlist entry on Linux, a stale process name, or an incomplete trust step on macOS. Start with a full restart of both the desktop app and Zen, since a restart clears cached state. Confirm the extension in Zen came from 1Password and not from a fork, because a forked extension will not speak the same trust protocol. Keep the desktop app running in the background, because the extension needs a live peer for the bridge.

For Linux:

• Extension asks for an account password each time. Open /etc/1password/custom_allowed_browsers and confirm a single clean line with zen-bin or the exact process name from pgrep -a zen. Remove duplicates and trailing spaces, then reopen both apps.

For macOS:

• No biometric pass-through in the browser. Open 1Password Settings, then Browser, and enable the option that links the extension to the desktop app. Reopen both apps to force a new bridge attempt.

Different Linux packaging:

• Some Flatpak or AppImage builds publish a different process name. Use pgrep -a zen to read the exact name and place that name in the allowlist.

Safety & privacy notes

The trusted browser list controls only which browser receives permission to talk to the desktop app. Vault encryption and account keys still live in 1Password, and the desktop app enforces those controls before any browser receives data. The bridge between desktop and extension uses an authenticated channel, so random processes do not receive vault data, even on a multi-user system. Adding Zen to the list therefore enables the link without lowering protection for the vault.

Sources and credit

The Adding another trusted browser article in the 1Password support site describes the trust model and the official flow for adding a browser. Community posts from u/xmansyx and u/feelspeaceman inspired the Linux method that uses a simple allowlist file. Thanks to those contributors for sharing clear steps that reduce friction for Zen users on Linux.